Compliance Program Charter - Texas

COMPLIANCE PROGRAM CHARTER — TEXAS SUPPLEMENT

Company: [________________________________]
Effective Date: [__/__/____]
Approved by: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Purpose and Authorization
2. Texas Regulatory Landscape
3. Scope — Texas Compliance Domains
4. Governance Enhancements
5. Core Program Elements — Texas Focus
6. Texas Regulatory Change Management
7. Texas-Specific Reporting and Metrics
8. Resources
9. Review and Approval
10. Annexes

1. PURPOSE AND AUTHORIZATION

This supplement addresses Texas-specific regulatory requirements including the TDPSA (effective July 1, 2024), the Texas breach notification statute, CUBI (biometric identifiers), the DTPA, and the TCHRA.

2. TEXAS REGULATORY LANDSCAPE

3. SCOPE — TEXAS COMPLIANCE DOMAINS

3.1 Privacy and Data Security

☐ TDPSA compliance: consumer rights (access, correction, deletion, portability, opt-out of targeted advertising, sale, profiling); processor obligations; data protection assessments; universal opt-out recognition; sensitive data consent
☐ Breach notification (§ 521.053): 60-day deadline; AG notification if >250 TX residents affected (HB 4, 2023)
☐ CUBI (§ 503.001): informed consent for biometric identifiers; no sale/disclosure; destruction within 1 year of purpose cessation

3.2 Consumer Protection

☐ DTPA (Ch. 17): prohibition of deceptive trade practices; laundry list of prohibited acts (§ 17.46(b)); treble damages for knowing violations
☐ Marketing, advertising, and sales practice review

3.3 Employment

☐ TCHRA (Lab. Code Ch. 21): discrimination and harassment protections (employers with 15+ employees)
☐ Texas Payday Law (Lab. Code Ch. 61): wage payment requirements
☐ At-will employment considerations

3.4 Biometric Data

☐ CUBI compliance program for any operations involving biometric identifiers
☐ Consent management and destruction tracking

4. GOVERNANCE ENHANCEMENTS

5. CORE PROGRAM ELEMENTS — TEXAS FOCUS

5.1 Risk Assessment — TX Additions

5.2 Policies — TX-Specific

☐ TDPSA privacy notice and consumer rights procedures
☐ Texas breach notification procedures (60-day timeline; AG notification for >250)
☐ CUBI biometric data policy (consent, retention, destruction)
☐ DTPA marketing/advertising review procedures
☐ TCHRA anti-discrimination/anti-harassment policy

5.3 Training — TX-Specific

5.4 Monitoring and Testing — TX Additions

☐ TDPSA consumer rights request handling verification
☐ Universal opt-out mechanism testing
☐ CUBI consent tracking and biometric destruction audit
☐ DTPA marketing review
☐ Breach notification tabletop (60-day timeline)
☐ TCHRA complaint tracking

5.5 Third-Party Risk — TX Additions

☐ TDPSA processor agreements for all TX data vendors (§ 541.105)
☐ CUBI vendor compliance for biometric data processing
☐ Vendor breach notification SLA alignment with 60-day timeline
☐ Data protection assessment cooperation requirements

6. TEXAS REGULATORY CHANGE MANAGEMENT

7. TEXAS-SPECIFIC REPORTING AND METRICS

8. RESOURCES

☐ Privacy team for TDPSA/CUBI
☐ Consumer protection review for DTPA
☐ Employment counsel for TCHRA
☐ External TX regulatory counsel

9. REVIEW AND APPROVAL

Review annually or upon material Texas regulatory change.

10. ANNEXES

Annex A: TX Breach Notification Checklist

☐ Breach determination (date: [__/__/____])
☐ 60-day notification clock starts (§ 521.053)
☐ Affected TX residents identified
☐ Individual notification prepared and sent
☐ If >250 TX residents: TX AG notified (HB 4, 2023)
☐ Records retained for AG inspection

Annex B: CUBI Compliance Checklist

☐ Biometric identifier inventory maintained (types: retina/iris scan, fingerprint, voiceprint, hand/face geometry)
☐ Informed consent obtained before capture (§ 503.001(b))
☐ Purpose and duration communicated to individuals before collection
☐ No sale, lease, or disclosure without consent (§ 503.001(c)(1))
☐ Stored with reasonable care, at least same standard as other confidential information (§ 503.001(c)(2))
☐ Destruction within 1 year of purpose cessation (§ 503.001(c)(3))
☐ Retention/destruction schedule documented and maintained
☐ Vendor CUBI compliance verified for biometric data processors
☐ Consent forms retained for audit purposes

Annex C: TDPSA Consumer Rights Compliance Checklist

☐ Privacy notice updated with TDPSA-required disclosures
☐ Consumer rights request intake mechanism operational
☐ Processes verified for all TDPSA rights:

• Right to confirm processing and access personal data (§ 541.051(1))
• Right to correct inaccurate personal data (§ 541.051(2))
• Right to delete personal data (§ 541.051(3))
• Right to obtain copy in portable format (§ 541.051(4))
• Right to opt out of targeted advertising (§ 541.051(5)(A))
• Right to opt out of sale of personal data (§ 541.051(5)(B))

• Right to opt out of profiling for legal/significant decisions (§ 541.051(5)(C))
  ☐ Response timeline: 45 days (extendable by 45 days with notice per § 541.055)
  ☐ Universal opt-out mechanism recognized (§ 541.055(e))
  ☐ Sensitive data consent mechanisms in place (§ 541.101(b)):

• Racial/ethnic origin

• Religious beliefs
• Mental/physical health diagnosis
• Sexual orientation
• Citizenship/immigration status
• Genetic data
• Biometric data for identification
• Children's data (under 13)
• Precise geolocation
  ☐ COPPA compliance for children under 13 (§ 541.101(b)(2))
  ☐ Data protection assessments completed for high-risk processing (§ 541.105(b))
  ☐ Processor agreements include TDPSA-required terms (§ 541.105(a))

Annex D: Texas Regulatory Calendar

Annex E: DTPA Compliance Checklist

☐ Marketing materials reviewed for deceptive trade practices
☐ Product/service representations verified for accuracy
☐ Pricing disclosures complete and not misleading
☐ Warranty and guarantee terms clearly stated
☐ Advertising claims substantiated with documentation
☐ Laundry list violations reviewed (§ 17.46(b)) — including:

• False representations of goods/services
• Failure to disclose material information
• Bait-and-switch practices
• Unconscionable actions
  ☐ Customer complaint tracking operational for DTPA-related issues

SOURCES AND REFERENCES

• TDPSA, Tex. Bus. & Com. Code Ch. 541 (eff. July 1, 2024)
• Tex. Bus. & Com. Code § 521.053 (Breach Notification; 60 Days)
• Tex. Bus. & Com. Code § 503.001 (CUBI)
• DTPA, Tex. Bus. & Com. Code Ch. 17
• TCHRA, Tex. Lab. Code Ch. 21
• HB 4 (88th Legislature, 2023) — AG enforcement enhancements
• DOJ Evaluation of Corporate Compliance Programs (2023)
• U.S. Sentencing Guidelines § 8B2.1

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.